I am unable to see my endpoints in the VMware Carbon Black Cloud Console. However, I can see multiple endpoints in Red Canary associated with the same device ID. Is there a way that I can remedy this issue?
VMware Carbon Black Cloud; VDI clones
Use RepCLI to force cloned VDI sensors to obtain a new device ID.
WARNING: The "reregister" command should only be run on cloned images because it will register the Sensor as a clone with the backend and VDI deregistration rules will apply.
- Log into the machine with a user account that matches the AD User or Group SID configured at the time of sensor install.
- Open a command prompt and navigate to C:\Program Files\Confer
- Enter the "repcli reregister now" command
C:\Program Files\Confer> repcli reregister now
Successfully scheduled re-registration
Note: If the sensors were deployed via SCCM or GPO, the above command can be deployed via a script to the affected endpoints.
Additional note: If Powershell is being used as opposed to an elevated command prompt, navigate to the C:\Program Files\Confer\ directory and execute the following command:
.\repcli reregister now
- Check the VMware Carbon Black Cloud Console to verify that the Sensor has updated the Device ID (Endpoints > Search by hostname)
Duplicate device ID assignments can be caused due to a misconfigured base image where the sensor was not installed using the VDI=1 or BASE_IMAGE=1 parameters. If the parameters are missing, it may result in the clones subsequently checking into the backed and being recognized as the same device.